CVE-2026-104084: Insufficient Session Expiration

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token...

PT-2026-108955

Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777 Description An issue exists where JSON Web Tokens JWT for access and refresh purposes embed a role claim at the time of issuance. This claim is not revalidated against the account's current role when...

CVE-2026-107719

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

NPM: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

NPM: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery vulnerability discovered by ? in WordPress Npm fast-jwt versions 6.2.4...

GHSA-G3JJ-5CMM-3HXX fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

Summary fast-jwt 6.2.4 silently classifies raw serialized public JWK JSON as an HMAC secret. If an application supplies public JWK JSON text as the verifier key and HS256 is explicitly allowed or automatically inferred, an attacker who knows the same public JSON text can use it as an HMAC key and...

CVE-2026-107724 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

EUVD-2026-95312

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

CVE-2026-107724

The fast-jwt library (version 6.2.4 ) contains a vulnerability where raw serialized public JWK or JWKS JSON can be incorrectly classified as an HMAC secret . The root cause is located in src/crypto.js within the performDetectPublicKeyAlgorithms function, which treats non-PEM strings as symmetric ...

CVE-2026-107724 fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery

fast-jwt provides fast JSON Web Token JWT implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, a...

CVE-2026-107719 fast-jwt: Verifier cache accepts expired JWTs without iat.

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

MAL-2026-17705 Malicious code in css-overscroll-contain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d978121f021eb6136e6a34db790556ba757de3bb8fa81981903445baf025d16 The package advertises itself as a CSS overscroll-behavior utility but its shipped modules thunderboltRegistry.js and sibling files named after...

CVE-2026-105570 Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host

Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider...

CVE-2026-105570

Docker Sandboxes are vulnerable to a security bypass where OAuth response masking can be circumvented using a case-variant token host . The root cause is a discrepancy in case sensitivity handling: the system compares OAuth token-endpoint hostnames case-sensitvely for masking decisions, but reque...

dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation

A flaw was found in Dovecot. This vulnerability allows an attacker to bypass authentication by exploiting how OAuth2 tokens are validated. If an OAuth2 token response does not include a scope claim, Dovecot incorrectly uses the audience claim in its place for authorization checks. This can lead t...

EUVD-2026-95128

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later...

CVE-2026-30945-PoC

🗑️ CVE-2026-30945 StudioCMS IDOR — Arbitrary API Token Revocation Leading to Denial of Service NVD • Advisory • CWE-639 Overview The DELETE /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user with editor privileges or above to revoke API tokens belonging...

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

Impact The cookie store ignores the scheme a Set-Cookie arrived on. draft-ietf-httpbis-rfc6265bis-22 approved to obsolete RFC 6265, in the RFC Editor queue Section 5.7 requires a user agent to ignore a cookie with the Secure attribute unless it arrived over a secure connection step 13, and to...

Protection Mechanism Failure

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Protection Mechanism Failure due to improper handling of the scheme when processing Set-Cookie headers. An attacker can overwrite, plant, or...

CVE-2026-107623

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

EUVD-2026-95034

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...